eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f

Analysis

max time kernel
117s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2022, 14:40

Target

eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe
Size

148KB
MD5

7e9d78145dfbfc48990d93d7842dc04e
SHA1

b420e4486ea56a147df886f7d1a244cb35bf830b
SHA256

eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f
SHA512

58c8efefee02afd30b16607fd9b2ba2dd33f3c83ea75ffe019dfa09142d608cfe7d6cd768215ad9852112264d76170b98e4c7da0ad81cf36b22e5797546a6e99
SSDEEP

3072:g6sMaPJH/JdjfawpbNKLVlffIL7+4Naskiido/WMUjOp:paBH/JJBtNKLV63adoSOp

Score

8^/10

upx

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/3532-137-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3532-140-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3532-141-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3532-143-0x0000000010000000-0x000000001000F000-memory.dmp	upx
behavioral2/memory/3532-144-0x0000000010000000-0x000000001000F000-memory.dmp	upx

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3532	4964	eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe	81
PID 4964 wrote to memory of 3532	4964	eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe	81
PID 4964 wrote to memory of 3532	4964	eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe	81

C:\Users\Admin\AppData\Local\Temp\eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe
"C:\Users\Admin\AppData\Local\Temp\eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\eb21675bd6ce4ba57327eb14e3b59b444ee8a8aff47d86a885f42cbe5ffb1c9f.exe
  ?
  2⤵
  PID:3532

memory/3532-137-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3532-140-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3532-141-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3532-143-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/3532-142-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/3532-144-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download
memory/4964-136-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download